Confidential and Proprietary Information of ZTE CORPORATION
159
C h a p t e r
8
Access Service
With the rapid expansion of Ethernet construction scale, to
meet fast increase of subscribers and requirement of diversified
broadband services, Network Access Service (NAS) is embedded
on the switch to improve authentication and management of
access subscribers and better support billing, security,
operation, and management of broadband network.
NAS uses the 802. 1x protocol and RADIUS protocol to realize
the authentication and management of access subscribers. It
is highly efficient, safe, and easy to operate.
IEEE 802. 1x is called port-based network access control
protocol. Its protocol system includes three key parts:
Client system is generally a user terminal system installed with
client software. A subscriber originates the IEEE802. 1x
protocol authentication process through this client software.
To support the port-based network access control, client system
must support Extensible Authentication Protocol Over LAN
(EAPOL).
Authentication system is generally network equipment that
supports IEEE802. 1x protocol, for example, switch.
Corresponding to ports of different subscribers (ports could be
physical ports or MAC address, VLAN, or IP address of user
equipment). Authentication system has two logical ports:
controlled port and uncontrolled port.
Uncontrolled port is always in the state that the bidirectional
connections are available. It is used to transfer EAPOL
frames and can ensure that client can always send or receive
authentication.
Control port is enabled only when authentication is passed.
It is used to transfer network resource and services.
Controlled port can be configured as bidirectional controlled
or input controlled to meet requirement of different
applications. If subscriber authentication is not passed,
this subscriber cannot visit services provided by
authentication system.
Introduction
Client System
Authentication
System
